Over 72,000 Samba File Servers Exposed to Public Internet, Security Audit Warns

Cybersecurity researchers using the ZoomEye scanning platform identified 72,819 Samba servers openly reachable from the public internet as of September 24, 2026. Samba implements the SMB protocol on Unix and Linux systems, enabling file sharing with Windows clients, and is widely used within corporate networks for document exchange. Experts warn that public internet exposure of SMB services typically signals a misconfigured firewall, an improperly placed file server, or an assumed-private hosting environment, rather than intentional design. Unlike management consoles that can be restricted behind a VPN, file servers are often accessible to a broad user base, making network-level restrictions harder to enforce. Security recommendations include disabling SMB1, enforcing signing, auditing anonymous access permissions, and using tools like ZoomEye to compare publicly visible services against internal inventories.